modify iptables and optimize